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DETAILED ACTION 
Claim Rejections - 35 USC § 102 

1. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(a) the invention was known or used by others in this country, or patented or described in a printed 
publication in this or a foreign country, before the invention thereof by the applicant for a patent. 

2. Claims 1 - 3, 7 - 9, and 13 - 18 are rejected under 35 ILS.C. 102(a) as being 
anticipated by Cookmeyer et al. (US 6,529,954 B1), hereafter Cookmeyer. 

3. Regarding claims 1, 7, 13, 15 and 17, Cookmeyer shows an apparatus, a 
computer-based method, an article of manufacture and an event management support 
system for providing decision support to an analyst in accordance with an event 
management system (Abstract) which manages a network with one or more computing 
devices (Figs. 2 and 7), the apparatus comprising 

at least one processor operative to perform: (i) an automated offline analysis of 
data representing past events associated with the network of computing devices being 
managed by the event management system (Figs. 8 and 28 and col. 21 lines 44 - 55, 
where the data source is a locally held log of network events, stored on a 'C:' local hard 
drive, and where the 'analyzer' is a local, non-network device connected to the host 
machine over a local bus (col. 7 lines 18-22), thus containing no 'online 1 
activity/analysis), the automated analysis comprising generation of one or visualizations 
of one or more portions of the past even data and discovery of one or more patterns in 
the past even data (Figs. 8, 18, 21-23 and 28, and col. 22 line 61 - col. 23 line 7); and 
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(ii) automated rule offline management comprising construction and validation of one or 
more rules (col. 12 lines 33-67 and col. 13 lines 3-20; where rule creation/customization 
is done on the host machine and where executed code is 'downloaded' from the host to 
the analyzer (col. 8 lines 25-30) as an offline operation as this 'download' is over a local 
parallel bus (col. 7 lines 20-25 and Fig. 2, where item 26=host, item 27=parallel cabel 
and item 28=analyzer) formed in accordance with the automated offline analysis of the 
past even data (col. 21 lines 44-55 and Fig. 14), wherein one or more rules are 
constructed offline and validated offline based directly on at least a portion of the one or 
more visualizations generated offline (col. 1 lines 50-67 and col. 22 lines 13-33; where 
rules can be created and constructed by users) from the corresponding offline analysis 
of the one or more portions of the past even data and the offline discovery of at least a 
portion of the one or more patterns in the past event data (col. 13 line 5 - col. 14 line 20 
and col. 12 lines 28-30); and 

memory, coupled to at least the one processor, which stores at least a portion of 
results associated with the automated offline event analysis and offline rule 
management operations (col. 26 lines 36-44 and col. 10 lines 26-28). 

4. Regarding claims 2, 8, 14, 16 and 18, Cookmeyer further shows wherein past 
event data is obtained from an event database and the one or more rules are provided 
to a rule database, the even database and the rule database being associated with an 
execution system of the event management system (col. 25 lines 37-43). 

5. Regarding claims 3 and 9, Cookmeyer further shows selecting a subset of the 
past even data from the event database, generating a visualization of the subset of past 
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even data using a visualization tool, the analyst reviewing the visualization to determine 
whether there are any groupings of events that are of interest presented therein, and 
performing an appropriate action where an event grouping of interest is found (col. 22 
line 61 - col. 23 line 7, col. 23 lines 40 - 60, and col. 24 lines 44 - 64). 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 4-6, 10-12 and 19 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Cookmeyer in view of Ma et al. (Mining Event Data for Actionable 
Patterns, 2000), hereafter Ma. 

8. Regarding claims 4 and 1 0, Cookmeyer shows selecting a subset of the past . 
event data from the event database (col. 22 line 61 - 23 line 7 and col. 24 lines 44 - 64), 
generating a visualization of the one or more patterns using a visualization tool (col. 22 
iines 50 - 63 and col. 24 iines 44 - 64), the analyst reviewing the visualization to 
determine whether there are any patterns of interest presented therein (col. 22 lines 50 - 
63 and col. 24 lines 44 - 64), and performing an appropriate action where a pattern of 
interest is found (col. 24 lines 44 - 64). 

Cookmeyer does not show mining a subset of the past even data to discover one 
or more patterns using a mining tool. 

Ma shows mining a subset of the past even data to discover one or more 
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patterns using a mining tool (pg. 4 section 2, algorithm 1). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Cookmeyer with that of Ma in order to improve the 
ability to identify patterns in enterprise event management (Ma, pg. 3, bottom right), 
thus improving the ability of Cookmeyer's disclosure to identify, diagnose and give 
advice to solve problems (as Cookmeyer's ability to identify and provide solutions to 
problems is based on identifying patterns). 

9. Regarding claims 5 and 1 1 , Cookmeyer in view of Ma further show selecting a 
subset of the past event data from the event database (Ma, pg. 4, paragraphs 3 and 4), 
finding one or more instances of patterns expressed in terms of left-hand side rules (Ma, 
pg. 2, paragraphs 2 and 3), generating a visualization of the one or more pattern 
instances using a visualization tool (Ma, pg. 2, paragraphs 3 and 4), analyzing the left- 
hand side rules using a rule validation tool (Ma, pg. 1, Fig. 1), displaying the results of 
the analysis operation (Ma, Fig. 3), the analyst assessing the analysis results (Ma, pg. 
3, 1 st paragraph) and making the rules as one of validated and not validated based on 
the assessment of the analyst (Ma, pg. 9, Fig. 6). 

1 0. Regarding claims 6 and 12, Cookmeyer in view of Ma further show selecting a 
subset of the past event data from the event database (Ma, pg. 6, paragraph 2), mining 
the subset of the past event data to discover the one or more patterns using a mining 
tool (Ma, pg. 6 paragraph 3), assessing significance of the one or more patterns using a 
visualization tool (Ma, pg. 2, paragraph 3 and pg. 3 paragraph 2), constructing the one 
or more rules from a selected subset of the one or patterns using a rule construction 
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tool (Ma, pg. 3, paragraph 3), and writing the one or more rules in a rule database (Ma, 
Fig. 1 and pg. 2 paragraph 2). 

1 1 . Regarding claim 1 9, Cookmeyer in view of Ma further show an event 
management decision support system for providing decision support to an event 
management system which manages a network with one or more computing devices 
(Cookmeyer, Abstract, Figs. 2 and 4, and Ma, Fig. 1), the system comprising: 

an event analysis module, further comprising an event mining module (Ma, Fig. 
1) and an event visualization module (Cookmeyer col. 21 lines 44-55 and Figs. 8 and 
28) wherein the event module discovers patterns in event data, and wherein the event 
visualization module provides a mechanism for visualizing at least a result of a pattern 
discovery and rule analysis (Ma, pg. 8 and Cookmeyer Figs. 8, 18, 21-23 and 28, col. 
22 line 61 - col. 23 line 7); and 

a rule management module, further comprising a rule validation module and a 
rule construction module (Cookmeyer col. 12 lines 33 - 67 and col. 14 lines 3 - 20), 
wherein the rule validation module maintains consistency of at least a rule with the even 
data, and wherein the rule construction module provides a mechanism for constructing 
one or more rules based on event patterns mined by the event mining module 
(Cookmeyer, col. 13 line 5 - col. 14 line 20 and col. 12 lines 28 - 30 and Ma, Fig. 1), 

wherein one or more of the rules are constructed offline by the rule construction 
module and validated offline by the rule validation module based directly on at least a 
portion of the one or more visualizations generated offline by the event visualization 
module from the corresponding offline analysis of the one or more portions of the event 
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data and the offline discovery of at least a portion of the one or more patterns in the 
event data by the event mining module (Ma, pg. 2 paragraph 3 and 4, pg. 3 paragraph 3 
and Cookmeyer col. 12 lines 50 - 67 and col. 22 lines 13 - 33). 

Response to Arguments 

12. Applicant's arguments filed 10/12/2007 have been fully considered but they are 
not persuasive. 

1 3. Applicant essentially argues that Cookmeyer does not show where the operation 
of the entire apparatus of claim 1 can be operated completely offline. However, there is 
no aspect of Cookmeyer's disclosure that requires online activity. That the entire 
operation of claim 1 is explicitly disclosed by Cookmeyer as being able to be performed 
offline. The Applicant seems to be indicating that the 'offline' reference of col. 21 line 46 
is directed to 'expert analysis' rather than said claimed 'automatic data analysis'. 
However, the use of 'offline' in col. 21, lines 44 - 46 is discussing choosing a 'capture 
data file' as opposed to performing a 'real time 1 analysis. The 'real time' analysis 
referred to by Cookmeyer would correspond to 'online' activity. However, utilizing the 
'capture data file' is clearly offline activity. The 'capture data file' (see Fig. 8 and 28) is 
clearly shown as stored on the local 'C:' hard drive. In a Windows environment, which is 
utilized by Cookmeyer (col. 7 lines 12 - 20), the 'C:' is used as a reference to the 
machines local, primary hard drive. The host machine, containing the 'C:' hard drive 
where the 'capture data file' resides, also communicates with an 'analyzer'. However, 
this communication is purely offline, as the 'analyzer' is connected to the host machine 
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over a local parallel bus. Given that the executed code is then run locally, offline, on the 
host computer (col. 8 lines 25 - 30), all activity performed by the apparatus is performed 
offline when a 'capture data file' is used. Therefore, Applicant's argument that 
Cookmeyer does not meet the 'offline' requirements of the pending claims is not 
persuasive. For further elaboration, please refer to the above rejections of the 
independent claims, made under 35 USC 102(a) in view of Cookmeyer. 
14. Applicant also discusses the language used by Cookmeyer regarding when rules 
can be defined, specifically that they can be defined at run time. Applicant correlates 
rules being defined at run time with online activity, and rules being defined at design 
time with offline activity. This argument is not persuasive, as 'run time' relates to when 
the application is executed, and has nothing to do with online activity. That Cookmeyer's 
disclosed application can be modified on the host computer at run time shows that it is 
flexible and adaptable, but does in no way relate to online activity or activity over a 
network. The application of Cookmeyer's disclosure runs on the host computer, which 
communicates with an analyzer. As Fig. 2 illustrates, the host computer (Fig. 2 item 26) 
communicates over a local data bus via a parallel cable (Fig. 2 item 27) with an 
analyzer (Fig. 2 item 28). This communication is entirely local, occurring over a local 
data bus, and is in no way related to online activity. The application's 'run time' is 
therefore in no way related to being online or online activity. 

Online activity, in another embodiment, can be present during run time. However, 
the embodiment relied on by the Examiner and cited in this office action (col. 21 lines 44 
- 55), where the data source is a local capture data file and not live network traffic, does 
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not involve any online activity. 

Applicant's argument therefore is not persuasive. 

15. Applicant also argues that Cookmeyer does not disclose utilizing data in the 
capture file to generate visualizations or to discover patterns, and states that rather 
Cookmeyer shows utilizing the capture file data to generate 'events' and 'symptoms'. 
However, Cookmeyer does indeed disclose generating visualizations, clearly shown in 
Figs. 8, 18, 21-23, as well as discovering patterns (col. 22 line 61 - col. 23 line 7). The 
events/symptoms that are reported to the user of Cookmeyer's disclosure are a result of 
Cookmeyer's disclosure analyzing the input data (in this embodiment, said input data is 
the offline capture data file) to create said visualizations shown in Figs. 8, 18 and 21-23, 
and the patterns are discovered and noted based on whether rules are satisfied (col. 12 
lines 20 - 67). For further elaboration, please refer to the above rejections of the 
independent claims, made under 35 USC 102(a) in view of Cookmeyer. Applicant's 
arguments therefore are not persuasive. 

16. Applicant's arguments regarding the Tenney reference are moot in view of the 
new grounds of rejection. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to John M. Frink whose telephone number is (571) 272- 
9686. The examiner can normally be reached on M-F 7:30AM - 5:00PM EST; off 
alternate Fridays. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on (571)272-3868. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



John Frink 



(571)272-9686 



^ JASON CARDONE 
SUPERVISORY PATENT EXAMINER 




